SonicWall Cloud Secure Edge Changelog

Platform — New Secure Private Access PoPs: Seoul and Dammam (September 2, 2026)

2026-09-02T00:00:00Z

Platform notice — a change to the parts of Cloud Secure Edge that SonicWall runs and updates for you. Affected component: Global Edge Network, Points of Presence (PoP) for Secure Private Access (SPA), provider-managed. Effective: 2026-09-02. Action required: Only if you want to use one of the new locations.

What’s new: The Secure Private Access (SPA) Global Edge Network has two new PoP locations as of September 2, 2026: Seoul (South Korea) and Dammam (Saudi Arabia).
Why it matters: Users, Connectors, and egress traffic in these regions now terminate at a local PoP instead of routing to another region, which shortens the path to private applications and keeps traffic inside the region for orgs with data residency requirements.
What you need to do: New SPA orgs can select these locations during onboarding. PoP editing is temporarily disabled for existing orgs, so contact SonicWall Support to request a PoP change.
IP allowlists: No change is required. The ingress and egress IPs for these locations are already published in the Global Edge Network IP Ranges doc and in the downloadable IP lists.
More information: PoP Locations · Managing PoPs

Platform — New Secure Private Access PoP: Johannesburg (August 31, 2026)

2026-08-31T00:00:00Z

Platform notice — a change to the parts of Cloud Secure Edge that SonicWall runs and updates for you. Affected component: Global Edge Network, Points of Presence (PoP) for Secure Private Access (SPA), provider-managed. Effective: 2026-08-31. Action required: Only if you want to use the new location.

What’s new: The Secure Private Access (SPA) Global Edge Network has a new PoP location as of August 31, 2026: Johannesburg (South Africa).
Why it matters: Users, Connectors, and egress traffic in the region now terminate at a local PoP instead of routing to another region, which shortens the path to private applications and keeps traffic inside the region for orgs with data residency requirements.
What you need to do: New SPA orgs can select this location during onboarding. PoP editing is temporarily disabled for existing orgs, so contact SonicWall Support to request a PoP change.
IP allowlists: No change is required. The ingress and egress IPs for this location are already published in the Global Edge Network IP Ranges doc and in the downloadable IP lists.
More information: PoP Locations · Managing PoPs

Product Updates — August 21 2026 Release Highlights

2026-08-21T00:00:00Z

Generally Available Features

[New] [Chrome Extension] Chrome Extension: The CSE Chrome Extension gives users clientless access to Hosted Websites and applies Internet Threat Protection (ITP) policies directly in Google Chrome, with no desktop app required. Install it from the Chrome Web Store, or distribute it through Zero Touch. It is a good fit for Chromebook fleets and for unmanaged or BYOD devices. Advanced (TLS-decryption) policies are not supported through the extension.
[New] [Desktop App] Native ARM64 build for the Windows desktop app (v4.5.0): Dedicated ARM64 EXE and MSI installers run natively on ARM Windows devices, without x86 emulation, and are supported on Windows 10 and 11. On x86-64 devices, continue to use the x86 installer. See Register the Desktop App.
[New] [Mobile App] Service Tunnel over port 443 (mobile): The mobile app can connect over TCP port 443 on networks that block the default UDP port. It is off by default and available on iOS and Android. See Mobile Tunnel.

Enhancements and Updates

Improved platform reliability and resilience:
- This release focuses on the foundations that keep Cloud Secure Edge available and responsive as usage grows.
- High-traffic API requests now use a single database connection per request.
- Service calls and third-party integration calls carry explicit timeouts and request cancellation, keeping a slow upstream provider contained to the request that triggered it.
- Memory and connection lifecycle management were tightened in the Linux Connector and in the REST API service.
[Mobile App] Mobile app availability: The updated mobile app is rolling out in stages through the Apple App Store and Google Play, and will be available to all users over the coming week.
[Mobile App] Android APK download: The Android app is now available as a downloadable APK, in addition to the Google Play Store listing. Use the APK to deploy the app on Android devices that cannot install from the Play Store, such as fleets where the store is blocked for compliance or regulatory reasons. The APK is the same app as the Play Store build, and you can install it manually or push it through your MDM. A download link is provided with each Android app version in this changelog.
Audit log for report downloads: An audit log is now generated when Access Logs or Proof of Value Reports are downloaded.
[Desktop App] Downgrade prevention: Installing an older version of the desktop app over a newer one is blocked. To use an earlier version, uninstall the current app first, and then install the older version you want. See Register the Desktop App.

Bug Fixes

[Netagent] [Fix] Users could not access internal resources when a Connector used public IP mode, due to a route mismatch.
[Desktop App] [Fix] In some cases, IPv6 traffic could bypass Internet Threat Protection (ITP) enforcement on Windows. This is resolved.
[Desktop App] [Fix] A burst of download notifications could overwhelm users in File Center. Notifications are now buffered.
[Desktop App] [Fix] Multiple trust factors were not evaluating as expected.
[Desktop App] [Fix] The desktop app window could stay positioned on an external display after that display was disconnected, so the app did not appear when the device was restarted with only the built-in screen. The window now returns to the primary display.
[Fix] Remote Diagnostics did not start log collection in some cases.
[Fix] Creating a Remote Diagnostics log could write to the file without stopping.
[Fix] After a Connector was renamed, the updated name was not reflected in the Service Tunnel configuration.

Netagent — v2.10.10 — August 21st 2026

2026-08-21T00:00:00Z

v2.10.10

Download:
- Netagent v2.10.10

Mobile App — v2.3.8 (Android and iOS) — August 21st, 2026

2026-08-21T00:00:00Z

v2.3.8 (Android and iOS)

Download:
- Android
- iOS
- Android APK

Desktop App — v4.5.0 — August 21st 2026

2026-08-21T00:00:00Z

v4.5.0

Download:

Product Updates — July 31 2026 Release Highlights

2026-07-31T00:00:00Z

Generally Available Features

[New] [ITP] Require a passcode to disable ITP:
- A new policy option restricts disabling Internet Threat Protection (ITP) to administrators only. To disable ITP, an end user must obtain a per-device one-time code from an admin, who reads it from the device’s Device Information page.
- The code auto-rotates, allows up to one hour of disablement, and is fully logged. It applies on both desktop and mobile. If an end user enters an incorrect passcode 10 times within a rolling 15-minute window, they are locked out from entering it for 15 minutes.
- The result is protection that end users cannot switch off on their own, a common compliance requirement.

Enhancements and Updates

[Private Access] [Netagent] FQDN access policy (Layer 4) improvements:
- Domain-based policies now track changing IP addresses in real time, including dynamic DNS resolutions, without disrupting established connections.
- This resolves intermittent drops and false blocks for applications with rotating IPs, such as Microsoft 365 and Cloudflare.
Geolocation is now standard for all organizations: Event Geolocation is enabled for every org, with no toggle to configure.
[UI] CSE HTTP Proxy and ITP are now separate toggles: In the CSE desktop app (version 4.4.0 and later), the control for Internet Threat Protection (ITP) and the control for the CSE HTTP Proxy, previously a single combined switch, are now independent, letting each be enabled or disabled on its own.
[Desktop App] A one-time passcode is no longer required when the desktop app’s device certificate or long-lived token silently renews in the background, for orgs with OTP-based email verification enabled.
Improved platform reliability under load: Backend database queries have been optimized to process requests more efficiently, improving the stability and responsiveness of core operations during periods of high demand, including trust score syncing, authentication and login, configuration syncing, starting new Service Tunnels, and infrastructure or hosted website connections.

Bug Fixes

[Fix] [UI] Linux Connectors can again be selected in Service Tunnel configuration. The connector name previously failed to appear, which blocked tunnel setup.
[Fix] “Last Login” now reports accurately in the Command Center.
[Fix] Firewall tunnel status now reports accurately in the Command Center.
[Fix] Device inventory is cleaned up on unregister. When a user unregisters, the mapping between the user and the device is now removed.
[Fix] Geolocation now uses the correct ISO country codes.
[Fix] Fixed devices receiving an unexpected role assignment.
[Fix] Firewall Trust Factor was intermittently reporting a Low Trust Level for multiple devices.

Connector — v2.0.12 (Linux, Windows, and VMware OVA) — July 31st 2026

2026-07-31T00:00:00Z

v2.0.12 (Linux, Windows, and VMware OVA)

Download:

Netagent — v2.10.9 — July 31st 2026

2026-07-31T00:00:00Z

v2.10.9

Download:
- Netagent v2.10.9

Desktop App — v4.4.0 — July 31st 2026

2026-07-31T00:00:00Z

v4.4.0

Download:
- macOS-Intel
- macOS-ARM
- Windows
- Windows MSI
- Linux-Deb
- Linux-RPM

Product Updates — June 29 2026 Release Highlights

2026-06-29T00:00:00Z

[Mobile App] [New] CSE Mobile App v2.3.7 (iOS and Android):
- Seamless background renewal of authentication tokens and certificates. Mobile users are no longer dropped to the registration screen or prompted for an invite code when their reporting token renews. Re-enrollment is only needed if a user’s token has fully expired after a long period without signing in. (An invite code is still required for first-time device enrollment.)
- Clearer re-authentication prompts when a session expires.
- [Fix] Fixed a connectivity issue that could affect VPN routing when switching from an IPv6-only network to an IPv4 network.

Mobile App — v2.3.7 (Android and iOS) — June 29th, 2026

2026-06-29T00:00:00Z

v2.3.7 (Android and iOS)

Download:
- Android
- iOS

Platform — PoP Editing temporarily disabled (June 23, 2026)

2026-06-23T00:00:00Z

Platform notice — a change to the parts of Cloud Secure Edge that SonicWall runs and updates for you. Affected component: Points of Presence (PoP) Management — provider-managed. Effective: 2026-06-23. Action required: No.

What’s changing: PoP Management — selecting, editing, and retiring PoPs — is temporarily disabled. As part of this pause, the retirement of unused PoPs is deferred until further notice.
Why: We are resolving connectivity issues that some customers experienced when swapping PoPs.
What you need to do: Nothing. Your existing PoP assignments remain active and unchanged.
If you need a PoP change in the interim: contact SonicWall Support.
More information: Managing PoPs · Known Issues

We will post here when PoP Editing is restored.

Product Updates — June 17 2026 Release Highlights

2026-06-17T00:00:00Z

Generally Available Features

Malware Download Protection is now available to all SIA Advanced customers:
- When you turn on File Analysis in an ITP policy, downloads are inspected by SonicWall Capture ATP before they reach your users’ devices. Anything flagged as malicious is blocked. See Malware Download Protection to enable it.

Enhancements and Updates

[UI] Updated Points of Presence (PoP) Management Banner:
- In August, CSE will retire PoPs your org hasn’t been using.
- This is a good time to take a look at your PoP configuration and update your selections so the PoPs you rely on stay active.
[UI] One place to bypass a domain or URL on an ITP policy:
- Domain Bypass and URL Allowlist are now one field: Domain & URL Bypass. Add an entry once, and it skips every rule on the policy: category filtering, threat protection, risk-based URL inspection, and file analysis.
- Existing entries are already in the new field; you don’t need to re-enter them. See Manage Internet Threat Protection (ITP) Policies.
Intelligent failover for Malware Download Analysis regions: File Analysis now automatically redirects inspection traffic to an alternate analysis region if the primary region becomes unavailable, so downloads continue to be inspected without admin intervention.
Performance improvements across the platform to reduce backend noise and improve responsiveness of the Command Center and the SWG inspection path.

Bug Fixes

[Fix] PoP selection and editing is available again: PoP selection and editing was temporarily unavailable and is now restored.
[Fix] Service Tunnel connectivity restored after PoP terminations: Users were unable to connect to Service Tunnels in cases where the Command Center showed the corresponding PoPs as terminated. The root cause was a sequencing issue in the Access Tier configuration, which has been corrected.
[Desktop App] [Fix] Windows: APIPA is now disabled on the wg0 WireGuard adapter to prevent the adapter from acquiring a 169.254.x.x link-local address when no Service Tunnel is connected. Service Tunnel connectivity is unchanged. See CSE Desktop App capabilities and components for details.
[Netagent] [Fix] No more duplicate entries in service_tunnel_accesses.log: A single Service Tunnel connection was being recorded multiple times in the Access Tier’s service_tunnel_accesses.log, which inflated disk usage and produced noisy data when used for reporting or monitoring. Each connection is now logged once.

Netagent — v2.10.8 — June 17th 2026

2026-06-17T00:00:00Z

v2.10.8

Download:
- Netagent v2.10.8

Desktop App — v4.3.1 — June 17th 2026

2026-06-17T00:00:00Z

v4.3.1

Download:
- macOS-Intel
- macOS-ARM
- Windows
- Windows MSI
- Linux-Deb
- Linux-RPM

Product Updates — June 8 2026 Release Highlights

2026-06-08T00:00:00Z

[Mobile App] [Hotfix] CSE Mobile App v2.3.6 (Service Tunnel stability improvement):
- Apps were at times displaying an error message about loading services or Service Tunnels after the Service Tunnel was connected, briefly interrupting internet connectivity.
- Users running v2.3.5 should upgrade to the latest version.
- On iOS, DNS resolution can still fail and the tunnel state can report inconsistently when switching from cellular to Wi-Fi. See our Known Issues doc for more information.

Mobile App — v2.3.6 (Android and iOS) — June 8th, 2026

2026-06-08T00:00:00Z

v2.3.6 (Android and iOS)

Download:
- Android
- iOS

Platform — Secure Internet Access (SIA) — Initial Seed Release (through June 2026)

2026-06-01T00:00:00Z

Platform notice — a change to the parts of Cloud Secure Edge that SonicWall runs and updates for you. Affected component: Secure Internet Access (SIA) — Secure Web Gateway (SWG) agent, provider-managed. Effective: June 2026. Action required: No.

This initial seed release of the Secure Web Gateway (SWG) agent adds real-time malware protection for file downloads, along with improvements to web filtering, block pages, and reliability.

Real-time malware protection on downloads (new)

The SWG agent now scans file downloads for malware as they happen. Files are identified by their true type using AI-based content inspection (not just the file extension), archives are unpacked for deeper analysis (gzip, deflate, Brotli, Zstandard, and compress), and content is checked against a cloud sandbox. If a file is found to be malicious while it is still downloading, the connection is cut immediately so the file never completes. Scanning runs alongside the download, so clean files are delivered with minimal delay.

Admins can exclude trusted URLs from malware inspection globally — for example, first-party or internal content sources.
Blocked downloads raise a structured event for SIEM and alerting workflows, and the block page is shown reliably to the user.

Web filtering and WAF

URL filtering now applies exclusion/allowlist rules before block decisions (previously, exclusions in URL filter policies were not applied).
Fixed URL pattern matching for rules that end with a path delimiter.
Faster repeat browsing: URL threat-intelligence results are cached, reducing lookups and latency for domains users visit often.
WAF now correctly recognizes Cloudflare challenge and block pages, inspects compressed response bodies, and excludes Atlassian sign-in pages so it does not interfere with SSO.

Block pages

Block pages now show why a request was blocked (for example, a content-category or threat-feed match) and the country of the blocked destination.

Reliability and performance

Lower latency: inspection steps run concurrently where possible, and policy lookups use the nearest regional location instead of always routing to one region.
More resilient DNS: the agent falls back to a public DNS resolver if the primary is unavailable, with a longer timeout for slow resolvers.
Resumed and partial downloads (including Firefox-style resume) are now handled correctly.
Faster, more reliable delivery of malware verdicts to the endpoint agent.
Malware scanning stays available during load or outages by retrying against backup analysis nodes.

Fixes

Fixed occasional page-loading (content-decoding) errors in browsers on HTTP/2 connections.
Fixed a Linux issue where certain device serial-number formats were misread, causing those devices to be misidentified and their policies not to apply.

Product Updates — May 26 2026 Release Highlights

2026-05-26T00:00:00Z

Generally Available Features

Five New Points of Presence Now Live:
- CSE’s Secure Private Access network has expanded to:
  - Los Angeles, California
  - Council Bluffs, Iowa
  - Ashburn, Virginia
  - Montreal, Canada
  - Stockholm, Sweden
- Users in these regions get faster application access without routing traffic across the country or overseas.
- For customers using the SonicWall Firewall Connector, local PoP coverage makes traffic routing significantly more efficient.
[Desktop App] New Windows MSI Installer:
- The CSE Desktop App now ships as a Windows MSI installer, letting IT teams deploy at scale through Intune, SCCM, or Group Policy.
- Zero-touch staging and built-in MDM context keep endpoints manageable from first install through every future upgrade, with no manual intervention or user prompts required.
- Note: Requires desktop app v4.3.0 or later. Earlier versions remain on the EXE installer. The MSI and EXE installers are mutually exclusive, so uninstall one before deploying the other.

Desktop App — v4.3.0 — May 26th 2026

2026-05-26T00:00:00Z

v4.3.0

Download:
- Windows MSI

Product Updates — May 22 2026 Release Highlights

2026-05-22T00:00:00Z

Generally Available Features

[Desktop App] New Install Switch:
- Both the Zero Touch script and MSI installers now support enabling Service Tunnel at installation.
- Because Service Tunnel runs over port 443, deployments succeed cleanly in restricted environments such as airports, cruise ships, and ISPs or countries that block WireGuard.
[Desktop App] Auto-Renewal for the Desktop App:
- Device certificates and long-lived tokens now renew silently in the background. Users never see a re-registration prompt, and enrolled devices stay enrolled.
- Invite code mismatches no longer prompt for re-registration at renewal, allowing admins to rotate the invite key.

Enhancements and Updates

[UI] New Points of Presence (PoP) Management Banner:
- A new banner in the Cloud Command Center points you to the PoP Management feature, where you can configure your org’s Points of Presence.
- No action is required in May, but we encourage you to take a look at which PoPs your org is currently using. Watch for a follow-up banner in June that will share the timeline for cleaning up unused PoPs in August.

Bug Fixes

[Fix] Commas used in service names were generating errors in saving hosted web services.
[Fix] [Desktop App] The CSE desktop app was failing authentication when a user took longer than 60 seconds to complete the login flow. The post-redirect response timeout has been extended to 10 minutes (up from 60 seconds); OAuth code exchange, SAML validity, and token lifetimes are unchanged.

Connector — v2.0.11 (Linux, Windows, and VMware OVA) — May 22nd 2026

2026-05-22T00:00:00Z

v2.0.11 (Linux, Windows, and VMware OVA)

Download:

Netagent — v2.10.7 — May 22nd 2026

2026-05-22T00:00:00Z

v2.10.7

Download:
- Netagent v2.10.7

Desktop App — v4.3.0 — May 22nd 2026

2026-05-22T00:00:00Z

v4.3.0

Service Tunnel over Port 443: The Zero Touch installer now includes a switch to route Service Tunnel traffic over port 443. In restricted environments — schools, government, financial services — where non-standard ports are blocked, deployments that previously required workarounds can now work directly.
Auto-Renewal for the Desktop App: Device certificates and long-lived tokens now renew silently in the background. Users never see a re-registration prompt, and enrolled devices stay enrolled. For IT teams managing large fleets, this eliminates a recurring operational burden and keeps support queues clear.
The CSE desktop app icon color has been updated from blue to orange.
[Fix] The CSE desktop app was failing authentication when a user took longer than 60 seconds to complete the login flow. The post-redirect response timeout has been extended to 10 minutes (up from 60 seconds); OAuth code exchange, SAML validity, and token lifetimes are unchanged.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Mobile App — v2.3.5 (Android and iOS) — April 27th, 2026

2026-04-27T00:00:00Z

v2.3.5 (Android and iOS)

Transitioned the publisher of the CSE mobile apps from BanyanOps Inc to SonicWall Cloud.
Download:
- Android
- iOS

Connector — v2.0.10 (Linux and Windows) — April 17th 2026

2026-04-17T00:00:00Z

v2.0.10 (Linux and Windows)

Download:
- Connector v2.0.10
- Windows Connector v2.0.10

Netagent — v2.10.6 — April 17th 2026

2026-04-17T00:00:00Z

v2.10.6

Download:
- Netagent v2.10.6

Desktop App — v4.2.0 — April 17th 2026

2026-04-17T00:00:00Z

v4.2.0

Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Product Updates — April-2026 Release Highlights

2026-04-01T00:00:00Z

Generally Available Features

Edit Points of Presence (PoP):
- Admins with orgs created before March 27th 2026 can now edit PoP locations in their org.
- Legacy PoP assignments are maintained in old orgs (i.e., orgs created before March 27th 2026) until an admin edits their PoP locations, at which point the new maximum is 4.
New Auto Update Toggle:
- Admins can now enable silent auto updating of apps in their org.
- This setting is enabled by default for new orgs and disabled for existing orgs.
- Note: Desktop app version 4.2.0+ is required for auto update on next restart.
New Event Hooks for Post-Connection Scripts on macOS devices:
- Admins can now use events generated by user connection to Service Tunnel as hooks to scripts that can automate various aspects of their workflows on macOS devices, as well as Windows devices.

Early Preview Features

New Malware Download Protection:
- Malware Download Protection (File Analysis in the console) adds real-time file inspection for users that have an Internet Threat Protection (ITP) policy applied to their devices.
- When enabled, downloaded files are analyzed in a sandbox powered by SonicWall Capture ATP before reaching the endpoint and automatically blocked if deemed malicious.
- Malware Download Protection is disabled by default.

Enhancements and Updates

New mobile app support for Active Service Tunnels:
- Active Service Tunnels on mobile devices are now reflected in the total Active Service Tunnels count.
New Service Tunnel Disconnect Logs:
- CSE now generates an event for Service Tunnel disconnections, helping admins to track Service Tunnel usage.
- Disconnect events include user-initiated disconnections and session timeouts.
Mac Installer Package Versioning (MDM):
- Mac installer package receipts now reflect the packaged app version.
Persistent Service Tunnel over TCP Toggle:
- When enabled, the Enable Service Tunnel over TCP toggle now stays on indefinitely, unless toggled off.

Bug Fixes

[Fix] Access Tier was removing quotes from cookies on hosted websites.
[Fix] Security policy attachment was lagging, blocking users from accessing resources via Service Tunnels.
[Fix] Domain name rules were not allowing users to include dashes in internal domain names.
[Fix] Service Tunnel access logs were flooded with duplicate entries.
[Fix] Service Tunnel was not reconnecting after login when installed using an MDM script.
[Fix] System log generation for Trusted Network config changes was not happening.

Mobile App — v2.3.4 (Android) — April 1st, 2026

2026-04-01T00:00:00Z

v2.3.4 (Android)

Fixed DNS connectivity during network changes.
App now displays Session Expiry time in app Settings.
Users can now save logs to their local device and share later, using Export Logs in app Settings.
General stability improvements
Download:
- Android

Mobile App — v2.3.4 (iOS) — March 30th, 2026

2026-03-30T00:00:00Z

v2.3.4 (iOS)

When Service Tunnel is connected and app is closed, tunnel remains active; when app is re-opened, tunnel re-syncs.
Users can extend their session from Settings before their session expires.
App now displays Session Expiry time in app Settings.
Users can now save logs to their local device and share later, using Export Logs in app Settings.
Download:
- iOS

Desktop App — v4.1.0 — March 27th 2026

2026-03-27T00:00:00Z

v4.1.0

New app-generated sessions for multi-user Service Tunnels.
Event hooks for post-connection scripts on Windows.
[Fix] Service Tunnel Active Connection was reporting inconsistently.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Desktop App — v.4.0.1 — March 5th 2026

2026-03-05T00:00:00Z

v.4.0.1

Cloud Secure Edge support for MacOS 26.3.1: The CSE App must be upgraded to v4.0.1 before upgrading to MacOS 26.3.1.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Product Updates — March-2026 Release Highlights

2026-03-01T00:00:00Z

Generally Available Features

[Netagent] New Points of Presence (PoP) Management:
- Admins can now select geographic locations in which they want to provision points of presence (PoPs).
- PoP selection is available for new orgs (created after March 27th, 2026) with SPA licensing.
[Desktop App] Event Hooks for Post-Connection Scripts on Windows devices:
- Admins can now use events generated by user connection to Service Tunnel as hooks to scripts that can automate various aspects of their workflows.
- Event hooks are only supported on Windows devices with CSE desktop app version 4.10.0 or later.

Enhancements and Updates

[Desktop App] New app-generated sessions for multi-user Service Tunnels:
- Now, when the CSE desktop app detects a user switch, it triggers a new session.

Bug Fixes

[Fix] [Desktop App] Service Tunnel Active Connection was reporting inconsistently.
[Fix] [UI] Users were unable to add an email address with the apostrophe character as part of a Role.

Desktop App — v.4.0.0 — February 19th 2026

2026-02-19T00:00:00Z

v.4.0.0

Desktop app re-brand: App executable names, package names, service names, and directory names are now SonicWall Cloud Secure Edge branded.
[Fix] Application Check Trust Factor not updating in real time.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Connector — v2.0.9 (Linux and Windows) — February 17th 2026

2026-02-17T00:00:00Z

v2.0.9 (Linux and Windows)

Download:
- Connector v2.0.9
- Windows Connector v2.0.9

Netagent — v2.10.5 — February 17th 2026

2026-02-17T00:00:00Z

v2.10.5

[New] Points of Presence (PoP) Management: Admins can now select geographic locations in which they want to provision points of presence (PoPs). PoP selection is available for new orgs (created after March 27th, 2026) with SPA licensing.
[Fix] A 3rd-party vulnerability scanner was producing false positives.
Download:
- Netagent v2.10.5

Product Updates — February-2026 Release Highlights

2026-02-01T00:00:00Z

Generally Available Features

[UI] Force re-authentication support for SAML:
- Admins can now use a toggle in the SAML IdP settings to enable force re-authentication.
- When enabled, users must re-enter credentials (i.e., password and MFA) each time they log into the CSE app or access a federated SaaS app.
- Hosted Websites will require authentication only once per active session.

Enhancements and Updates

[Desktop App] Cloud Secure Edge support for MacOS 26.3.1:
- The CSE App must be upgraded to v4.0.1 before upgrading to MacOS 26.3.1.
[Desktop App] Cloud Secure Edge desktop app re-branding:
- Code signing certificate is now SonicWall branded
- App executable names, package names, service names, and directory names are now SonicWall Cloud Secure Edge branded.
- For Zero Touch installations on desktop app v. 4.0.0 or later, admins should use this desktop app installer for mdm.

Bug Fixes

[Fix] [Desktop App] Application Check Trust Factor not updating in real time.
[Fix] [Netagent] A 3rd-party vulnerability scanner was producing false positives.

Connector — v2.0.8 (Linux and Windows) — January 16th 2026

2026-01-16T00:00:00Z

v2.0.8 (Linux and Windows)

Download:
- Connector v2.0.8
- Windows Connector v2.0.8

Netagent — v2.10.4 — January 16th 2026

2026-01-16T00:00:00Z

v2.10.4

[New] CORS toggle: Admins can now enable a CORS toggle to secure authorization requests on hosted websites.
[Fix] Service Tunnel performance improved.
Download:
- Netagent v2.10.4

Desktop App — v3.28.1 — January 16th 2026

2026-01-16T00:00:00Z

v3.28.1

[Fix] Auto-Update Trust Factor was failing.
[Fix] Multiple PowerShells were running indefinitely.
[Fix] After zero-touch deployments, tunnels were not auto-connecting.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Product Updates — January-2026 Release Highlights

2026-01-01T00:00:00Z

Early Preview Features

[Netagent] New CORS toggle:
- Admins can now enable a CORS toggle to secure authorization requests on hosted websites.

Generally Available Features

[UI] New Firewalls tab:
- Admins can now view a comprehensive list of Gen7+ firewalls inside the CSE Command Center.
- The firewalls displayed can be used to configure the CSE Connector.
[UI] Gemini Log Summarizer:
- Admins can now view an AI summary of logs and events in the CSE Command Center.

Bug Fixes

[Fix] [Desktop App] Auto-Update Trust Factor was failing.
[Fix] [Desktop App] Multiple PowerShells were running indefinitely.
[Fix] [Desktop App] After zero-touch deployments, tunnels were not auto-connecting.
[Fix] [Netagent] Service Tunnel performance improved.
[Fix] [UI] Entra ID Auto-Config was generating the incorrect redirect URL for orgs on net.

Netagent — v2.10.3 (Private Edge Netagents) — December 18th 2025

2025-12-18T00:00:00Z

v2.10.3 (Private Edge Netagents)

Download:
- Netagent v2.10.3
[Fix] Duplicate entries within the service_tunnel_accesseslog.

Product Updates — December-2025 Release Highlights

2025-12-01T00:00:00Z

Generally Available Features

[UI] New Internet Access Logging:
- Admins can now view Internet Access Logs, which detail users’ access activity, including blocked access attempts and the reason for the block.
- Internet Access Log entries include a downloadable CSV file that admins can use for compliance and incident response.
[ITP] New AI & ML Category in Internet Threat Protection Policies:
- Admins can now block internet content categorized as Artificial Intelligence (AI) and Machine Learning (ML) (i.e., AI & ML) in Internet Threat Protection policies.
[UI] New Proof of Value Reporting:
- SIA and SPA orgs now display high-level reports to provide a visual overview of protected devices, licensed users, web activity (threat/compliance/allowed), and device Trust Level in an org.

Enhancements and Updates

[UI] New maximum for Admin token session (i.e., every 12 hours).

Bug Fixes

[Fix] [Connector] LDAP configuration was disappearing when the Connector was disconnected.
[Fix] [Netagent] Duplicate entries within the service_tunnel_accesseslog.

Connector — v2.0.7 (Linux and Windows) — November 11th, 2025

2025-11-11T00:00:00Z

v2.0.7 (Linux and Windows)

[Fix] LDAP configuration was disappearing when the Connector was disconnected.
Download:
- Connector v2.0.7
- Windows Connector v2.0.7

Mobile App — v2.3.3 (Android and iOS) — November 11th, 2025

2025-11-11T00:00:00Z

v2.3.3 (Android and iOS)

[Fix] Android Auto was not working when users were connected to CSE.
Download:
- Android
- iOS

Desktop App — v3.28.0 — November 11th 2025

2025-11-11T00:00:00Z

v3.28.0

[New] ARM Architecture support on CSE desktop app: Desktop app now supports ARM architecture on macOS and Windows devices.
[Fix] Service Tunnel was failing to connect over TCP.
[Fix] Firewall Trust Factor erroneously reporting a Low Trust Level.
[Fix] Mandarin characters were displayed in the app after upgrading to v3.26.0.
[Fix] Service Tunnel exclude public domains function was not working on Windows devices.
Download:
- macOS-Intel
- macOS-ARM
- Windows
- Linux-Deb
- Linux-RPM

Product Updates — November-2025 Release Highlights

2025-11-01T00:00:00Z

Generally Available Features

[UI] New Entra ID API Auto-Configuration:
- Admins can now set up API auto-configuration with Entra ID, instead of manually configuring Entra ID as an IdP in Cloud Secure Edge.
[Desktop App] New ARM Architecture support on CSE desktop app:
- Desktop app now supports ARM architecture on macOS and Windows devices.

Enhancements and Updates

[UI] Improved the UI experience for device root certificate and reporting token expiry.
[ITP] Explicit URL Blocking is now available.

Bug Fixes

[Fix] [UI] User report in admin console was only displaying registered users.
[Fix] [Desktop App] Service Tunnel was failing to connect over TCP.
[Fix] [Desktop App] Firewall Trust Factor erroneously reporting a Low Trust Level.
[Fix] [Desktop App] Mandarin characters were displayed in the app after upgrading to v3.26.0.
[Fix] [Desktop App] Service Tunnel exclude public domains function was not working on Windows devices.
[Fix] [Mobile App] Android Auto was not working when users were connected to CSE.

Connector — v2.0.6 (Linux and Windows) — September 10th 2025

2025-09-10T00:00:00Z

v2.0.6 (Linux and Windows)

Windows C++ Redistributable is now packaged with the Windows Connector installer.
Download:
- Connector v2.0.6
- Windows Connector v2.0.6